The tihng I don't understand is why does it work with postman.
I mean I paste the exact same thing there, and it works fine.

So for example, I login from the app, I take the session ID string, and I construct the logout url and trigger it from Postman, and it works just fine. Returns ok, and indeed, the current user session is removed.

Hmm.. weird.

Oh, lol, even tho it gives access deinied, inside data I can see status : ok. And I could see that, indeed, the session got deleted. So weird !